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Listing of Claims: 

1. - 7. (Canceled) 

8. (Previously Presented) A method for transmitting data between a fail safe computer 
and a plurality of input/output modules via a bus control unit, said bus control unit being 
connected to said plurality of input/output modules via a serial bus and being connected to the 
fail safe computer, comprising cyclically carrying out following steps: 

transmitting, via the bus control unit, a first address over the serial bus for addressing one 
of the input/output modules; 

transmitting, via the bus control unit, a first multi-bit message over the serial bus to the 
input/output module addressed by the first address, the first multi-bit message including at least 
one first check bit and at least one first load bit; 

receiving, at the input/output module addressed by the first address, the first multi-bit 
message; and 

accepting, at the input/output module addressed by said first address, the first multi-bit 
message as correct only if the at least one first check bit is different from a corresponding first 
check bit included in a previous first multi-bit message received by the input/output module 
when addressed by the first address. 

9. (Previously Presented) A method according to claim 8, wherein the addressed 
input/output module additionally executes, the steps of: 
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resetting a timer belonging to the addressed input/output module, if and only if said at 
least first one check bit is different from the corresponding first check bit included in the 
previous first multi-bit message received by this input/output module when addressed by the first 
address, 

switching an output of the addressed input/output module to a secure condition when said 
timer has run out; and 

determining a state of the output according to the at least one first load bit as long as the 
timer has not run out. 

10. (Previously Presented) A method according to claim 8, further comprising the steps 

of: 

transmitting, via the bus control unit, a second address over the serial bus for addressing 
the input/output module already addressed by the first address also by the second address; 

transmitting, via the bus control unit, a second multi-bit message over the serial bus to the 
input/output module addressed by the second address, the second multi-bit message including at 
least one second check bit and at least one second load bit; 

receiving, at the input/output module addressed by the second address, the second multi- 
bit message; and 

accepting, at the input/output module addressed by the second address, the second multi- 
bit message as correct only if the at least one second check bit is different from a corresponding 
second check bit included in a previous second multi-bit message transmitted to the input/output 
module when addressed by the second address. 
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1 1 . (Previously Presented) A method according to claim 10, further comprising the steps 

of: 

comparing, at the input/output module addressed by the first and second addresses, the 
first and second multi-bit messages; and 

accepting, at the input/output module addressed by the first and second addresses, the 
first and second multi-bit messages as correct only if said first and second multi-bit messages 
correspond to each other. 

12. (Previously Presented) A method according to claim 8, wherein the number of first 
load bits is at least four. 

13. (Previously Presented) A method according to claim 9, wherein the number of first 
load bits is at least four. 

14. (Previously Presented) A method according to claim 10, wherein the number of first 
load bits is at least four. 

15. (Previously Presented) A method according to claim 11, wherein the number of first 
load bits is at least four. 
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